You visit hsbс-bαnk .xyz from a phishing message.
You type in your username & password.
The fake site sends them to the *real* bank.
Then it asks for your 2FA code - you type it in.
The fake site uses your code to log in to the real bank.
2FA will *not* protect you in this scenario!
So what does?
